Demilitarized Zone
Also known as:DMZ
Demilitarized Zone: A separate network segment for publicly accessible services located between internal and external networks. The control governs network communication or access. Effectiveness is achieved through restrictive rules, segmentation, continuous monitoringMonitoringThe continuous observation of systems, identities, networks, and controls for relevant changes., and coordinated response processesResponse ProcessA coordinated sequence of decisions and actions for handling security events and incidents..
How it works and where it fits
Demilitarized Zone is a preventive, detective, or corrective security control. Its effect depends on where it sits in the architecture, which data and decisions it processes, and how it might be bypassed. A control reduces a defined risk but rarely removes it completely, so it should be combined with additional layers of protection.
Practical security relevance
Before deployment, the objective, ownership, coverage, and expected behavior should be defined. Secure defaults, controlled exceptions, logging, and periodic effectiveness tests matter more than installation alone. Operational metrics should expose both blocked or detected activity and gaps, false alerts, and effects on legitimate business processes.
Related concepts
- Network SegmentationNetwork SegmentationSeparates network segments to control access and limit lateral movement.: Separates network segments to control access and limit lateral movement.
- Intrusion Detection SystemIntrusion Detection SystemDetects suspicious or anomalous activities on hosts or within networks.: Detects suspicious or anomalous activities on hosts or within networks.
- FirewallFirewallControls network traffic based on defined rules and security policies.: Controls network traffic based on defined rules and security policies.
- Zero Trust Network AccessZero Trust Network AccessGrants application-specific remote access based on identity, device state, and context.: Grants application-specific remote access based on identity, device state, and context.